claude-dev-env 2.8.0 → 2.10.0

package/skills/e-code-review/scripts/test_finding_pipeline.py

@@ -0,0 +1,197 @@
+"""Red fixtures: low-severity findings survive collection; filter is separate."""
+
+from __future__ import annotations
+
+import sys
+from pathlib import Path
+
+import pytest
+
+_SCRIPTS_DIR = Path(__file__).resolve().parent
+if str(_SCRIPTS_DIR) not in sys.path:
+    sys.path.insert(0, str(_SCRIPTS_DIR))
+
+from e_code_review_scripts_constants.finding_pipeline_constants import (
+    ALL_COLLECTION_SEVERITIES,
+    COLLECTION_STAGE_NAME,
+    FILTER_STAGE_NAME,
+    FINDING_FIELD_CATEGORY,
+    FINDING_FIELD_EVIDENCE,
+    FINDING_FIELD_FILE,
+    FINDING_FIELD_LINE,
+    FINDING_FIELD_SEVERITY,
+    REPORT_EVERY_FINDING_INSTRUCTION,
+    SEVERITY_BLOCKER,
+    SEVERITY_HIGH,
+    SEVERITY_LOW,
+    SEVERITY_MEDIUM,
+    SEVERITY_NIT,
+)
+from finding_pipeline import (
+    CollectedFinding,
+    FindingCollection,
+    collect_findings,
+    filter_findings_by_severity,
+)
+
+
+def _seeded_findings() -> list[CollectedFinding]:
+    return [
+        CollectedFinding(
+            file_path="pkg/a.py",
+            line_number=10,
+            severity=SEVERITY_BLOCKER,
+            category="correctness",
+            evidence="raises on empty input",
+        ),
+        CollectedFinding(
+            file_path="pkg/b.py",
+            line_number=20,
+            severity=SEVERITY_HIGH,
+            category="security",
+            evidence="shell=True with user text",
+        ),
+        CollectedFinding(
+            file_path="pkg/c.py",
+            line_number=30,
+            severity=SEVERITY_MEDIUM,
+            category="api-contracts",
+            evidence="return type narrowed",
+        ),
+        CollectedFinding(
+            file_path="pkg/d.py",
+            line_number=40,
+            severity=SEVERITY_LOW,
+            category="simplification",
+            evidence="duplicated helper body",
+        ),
+        CollectedFinding(
+            file_path="pkg/e.py",
+            line_number=50,
+            severity=SEVERITY_NIT,
+            category="conventions",
+            evidence="typo in comment",
+        ),
+    ]
+
+
+def test_collection_retains_every_seeded_severity_including_low_and_nit() -> None:
+    all_seeded = _seeded_findings()
+    collection = collect_findings(all_seeded)
+
+    assert collection.stage_name == COLLECTION_STAGE_NAME
+    all_severities = {
+        each.severity for each in collection.all_findings
+    }
+    assert all_severities == set(ALL_COLLECTION_SEVERITIES)
+    assert len(collection.all_findings) == len(all_seeded)
+    low_finding = next(
+        each for each in collection.all_findings if each.severity == SEVERITY_LOW
+    )
+    assert low_finding.file_path == "pkg/d.py"
+    assert low_finding.line_number == 40
+    assert low_finding.evidence == "duplicated helper body"
+    assert low_finding.category == "simplification"
+
+
+def test_each_collected_finding_keeps_file_line_evidence_and_category() -> None:
+    collection = collect_findings(_seeded_findings())
+    for each_finding in collection.all_findings:
+        as_mapping = each_finding.as_mapping()
+        assert as_mapping[FINDING_FIELD_FILE]
+        assert as_mapping[FINDING_FIELD_LINE] > 0
+        assert as_mapping[FINDING_FIELD_EVIDENCE]
+        assert as_mapping[FINDING_FIELD_CATEGORY]
+        assert as_mapping[FINDING_FIELD_SEVERITY] in ALL_COLLECTION_SEVERITIES
+
+
+def test_filter_is_explicit_later_stage_and_does_not_mutate_collection() -> None:
+    collection = collect_findings(_seeded_findings())
+    collected_snapshot = [
+        (
+            each.file_path,
+            each.line_number,
+            each.severity,
+            each.category,
+            each.evidence,
+        )
+        for each in collection.all_findings
+    ]
+
+    filtered = filter_findings_by_severity(
+        collection,
+        minimum_severity=SEVERITY_MEDIUM,
+    )
+
+    assert filtered.stage_name == FILTER_STAGE_NAME
+    all_filtered_severities = {each.severity for each in filtered.all_findings}
+    assert SEVERITY_LOW not in all_filtered_severities
+    assert SEVERITY_NIT not in all_filtered_severities
+    assert SEVERITY_MEDIUM in all_filtered_severities
+    assert SEVERITY_BLOCKER in all_filtered_severities
+
+    after_filter_snapshot = [
+        (
+            each.file_path,
+            each.line_number,
+            each.severity,
+            each.category,
+            each.evidence,
+        )
+        for each in collection.all_findings
+    ]
+    assert after_filter_snapshot == collected_snapshot
+    assert len(collection.all_findings) == 5
+
+
+def test_filter_rejects_unknown_minimum_severity() -> None:
+    collection = collect_findings(_seeded_findings())
+    with pytest.raises(ValueError, match="unknown minimum severity"):
+        filter_findings_by_severity(collection, minimum_severity="P1")
+
+
+def test_filter_rejects_unknown_finding_severity_with_value_error() -> None:
+    collection = FindingCollection(
+        stage_name=COLLECTION_STAGE_NAME,
+        all_findings=(
+            CollectedFinding(
+                file_path="pkg/x.py",
+                line_number=1,
+                severity="P0",
+                category="correctness",
+                evidence="bypass collect",
+            ),
+        ),
+    )
+    with pytest.raises(ValueError, match="unknown collection severity"):
+        filter_findings_by_severity(collection, minimum_severity=SEVERITY_LOW)
+
+
+def test_collect_rejects_finding_missing_required_fields() -> None:
+    with pytest.raises(ValueError, match="file"):
+        collect_findings(
+            [
+                CollectedFinding(
+                    file_path="",
+                    line_number=1,
+                    severity=SEVERITY_LOW,
+                    category="correctness",
+                    evidence="x",
+                )
+            ]
+        )
+
+
+def test_report_every_finding_instruction_names_all_severities() -> None:
+    for each_severity in ALL_COLLECTION_SEVERITIES:
+        assert each_severity in REPORT_EVERY_FINDING_INSTRUCTION
+    assert "consumer stage" in REPORT_EVERY_FINDING_INSTRUCTION
+    assert "Do not drop findings by severity during collection" in (
+        REPORT_EVERY_FINDING_INSTRUCTION
+    )
+
+
+def test_collection_record_type_is_immutable() -> None:
+    collection = collect_findings(_seeded_findings())
+    assert isinstance(collection, FindingCollection)
+    assert collection.stage_name == COLLECTION_STAGE_NAME

package/skills/e-code-review/scripts/test_grok_code_review.py

@@ -0,0 +1,289 @@
+"""Behavioral tests for Grok medium-review discovery and verification."""
+
+from __future__ import annotations
+
+import sys
+from pathlib import Path
+
+import pytest
+
+_SCRIPTS = Path(__file__).resolve().parent
+if str(_SCRIPTS) not in sys.path:
+    sys.path.insert(0, str(_SCRIPTS))
+
+from e_code_review_scripts_constants.grok_code_review_constants import (  # noqa: E402
+    ALL_MEDIUM_FINDER_ANGLES,
+    MEDIUM_REVIEW_FINDER_COUNT,
+    VERDICT_CONFIRMED,
+    VERDICT_PLAUSIBLE,
+    VERDICT_REFUTED,
+)
+from grok_code_review import (  # noqa: E402
+    FinderCandidate,
+    deduplicate_candidates,
+    require_exact_finder_set,
+    retain_verified_findings,
+    run_medium_review,
+)
+
+
+def _candidate(
+    angle: str,
+    *,
+    file_path: str = "a.py",
+    line_number: int = 1,
+    mechanism: str = "m",
+    scenario: str = "short",
+    suffix: str = "",
+    head: str = "head1",
+) -> FinderCandidate:
+    token = suffix or angle
+    return FinderCandidate(
+        angle=angle,
+        file_path=file_path,
+        line_number=line_number,
+        mechanism=mechanism,
+        scenario=scenario,
+        worktree_path=f"/wt/{token}",
+        leader_socket=f"sock-{token}",
+        advisor_session_id=f"adv-{token}",
+        reviewed_head=head,
+    )
+
+
+def test_require_exact_finder_set_accepts_all_angles() -> None:
+    require_exact_finder_set(ALL_MEDIUM_FINDER_ANGLES)
+    with pytest.raises(ValueError):
+        require_exact_finder_set(ALL_MEDIUM_FINDER_ANGLES[:-1])
+
+
+def test_deduplicate_keeps_most_concrete_scenario() -> None:
+    short = _candidate("correctness", scenario="short")
+    long = _candidate("security", scenario="much more concrete failure path")
+    # same key different angles - force same file/line/mech
+    short = FinderCandidate(
+        angle="correctness",
+        file_path="a.py",
+        line_number=3,
+        mechanism="null",
+        scenario="x",
+        worktree_path="/wt/a",
+        leader_socket="s1",
+        advisor_session_id="a1",
+        reviewed_head="h",
+    )
+    long = FinderCandidate(
+        angle="security",
+        file_path="a.py",
+        line_number=3,
+        mechanism="null",
+        scenario="concrete long scenario",
+        worktree_path="/wt/b",
+        leader_socket="s2",
+        advisor_session_id="a2",
+        reviewed_head="h",
+    )
+    kept = deduplicate_candidates([short, long])
+    assert len(kept) == 1
+    assert kept[0].scenario == "concrete long scenario"
+
+
+def test_run_medium_review_happy_path() -> None:
+    head = "abc123"
+    all_finders = [
+        _candidate(each_angle, head=head, suffix=each_angle)
+        for each_angle in ALL_MEDIUM_FINDER_ANGLES
+    ]
+    # make unique keys per angle
+    all_finders = [
+        FinderCandidate(
+            angle=each_angle,
+            file_path=f"{each_angle}.py",
+            line_number=1,
+            mechanism="m",
+            scenario=f"scenario {each_angle}",
+            worktree_path=f"/wt/{each_angle}",
+            leader_socket=f"sock-{each_angle}",
+            advisor_session_id=f"adv-{each_angle}",
+            reviewed_head=head,
+        )
+        for each_angle in ALL_MEDIUM_FINDER_ANGLES
+    ]
+    verdicts = {
+        (f"{each}.py", 1, "m"): VERDICT_CONFIRMED
+        for each in ALL_MEDIUM_FINDER_ANGLES
+    }
+    severities = {
+        (f"{each}.py", 1, "m"): "medium" for each in ALL_MEDIUM_FINDER_ANGLES
+    }
+    # refute one
+    first = ALL_MEDIUM_FINDER_ANGLES[0]
+    verdicts[(f"{first}.py", 1, "m")] = VERDICT_REFUTED
+    batch = run_medium_review(
+        target_head=head,
+        diff_base="base",
+        all_finder_candidates=all_finders,
+        verdict_by_key=verdicts,
+        severity_by_key=severities,
+        live_head=head,
+    )
+    assert batch.is_rejected is False
+    assert len(batch.all_finder_angles) == MEDIUM_REVIEW_FINDER_COUNT
+    assert all(each.reviewed_head == head for each in batch.all_retained_findings)
+    assert all(each.verdict in {VERDICT_CONFIRMED, VERDICT_PLAUSIBLE} for each in batch.all_retained_findings)
+    assert len(batch.all_retained_findings) == MEDIUM_REVIEW_FINDER_COUNT - 1
+
+
+def _one_candidate_per_angle(head: str) -> list[FinderCandidate]:
+    return [
+        FinderCandidate(
+            angle=each_angle,
+            file_path=f"{each_angle}.py",
+            line_number=1,
+            mechanism="m",
+            scenario=f"scenario {each_angle}",
+            worktree_path=f"/wt/{each_angle}",
+            leader_socket=f"sock-{each_angle}",
+            advisor_session_id=f"adv-{each_angle}",
+            reviewed_head=head,
+        )
+        for each_angle in ALL_MEDIUM_FINDER_ANGLES
+    ]
+
+
+def test_a_finder_reporting_several_candidates_is_not_a_identity_clash() -> None:
+    head = "abc123"
+    all_finders = _one_candidate_per_angle(head)
+    first = all_finders[0]
+    second_from_first_finder = FinderCandidate(
+        angle=first.angle,
+        file_path="second.py",
+        line_number=9,
+        mechanism="m",
+        scenario="a second finding from the same finder",
+        worktree_path=first.worktree_path,
+        leader_socket=first.leader_socket,
+        advisor_session_id=first.advisor_session_id,
+        reviewed_head=head,
+    )
+    all_finders.append(second_from_first_finder)
+    all_keys = [
+        (each.file_path, each.line_number, each.mechanism) for each in all_finders
+    ]
+    batch = run_medium_review(
+        target_head=head,
+        diff_base="base",
+        all_finder_candidates=all_finders,
+        verdict_by_key={each_key: VERDICT_CONFIRMED for each_key in all_keys},
+        severity_by_key={each_key: "medium" for each_key in all_keys},
+        live_head=head,
+    )
+    assert batch.is_rejected is False
+    assert batch.rejection_reason is None
+    assert len(batch.all_retained_findings) == len(all_finders)
+
+
+def test_two_finders_sharing_one_socket_reject_the_batch() -> None:
+    head = "abc123"
+    all_finders = _one_candidate_per_angle(head)
+    first = all_finders[0]
+    second = all_finders[1]
+    all_finders[1] = FinderCandidate(
+        angle=second.angle,
+        file_path=second.file_path,
+        line_number=second.line_number,
+        mechanism=second.mechanism,
+        scenario=second.scenario,
+        worktree_path=second.worktree_path,
+        leader_socket=first.leader_socket,
+        advisor_session_id=second.advisor_session_id,
+        reviewed_head=head,
+    )
+    batch = run_medium_review(
+        target_head=head,
+        diff_base="base",
+        all_finder_candidates=all_finders,
+        verdict_by_key={},
+        severity_by_key={},
+        live_head=head,
+    )
+    assert batch.is_rejected is True
+    assert batch.rejection_reason == "non_unique_finder_identity"
+
+
+def test_head_drift_rejects_batch() -> None:
+    head = "h1"
+    all_finders = [
+        FinderCandidate(
+            angle=each_angle,
+            file_path=f"{each_angle}.py",
+            line_number=1,
+            mechanism="m",
+            scenario="s",
+            worktree_path=f"/wt/{each_angle}",
+            leader_socket=f"sock-{each_angle}",
+            advisor_session_id=f"adv-{each_angle}",
+            reviewed_head=head,
+        )
+        for each_angle in ALL_MEDIUM_FINDER_ANGLES
+    ]
+    batch = run_medium_review(
+        target_head=head,
+        diff_base="b",
+        all_finder_candidates=all_finders,
+        verdict_by_key={},
+        severity_by_key={},
+        live_head="other",
+    )
+    assert batch.is_rejected is True
+    assert batch.rejection_reason == "head_drift"
+
+
+def test_advisor_blocked_rejects_batch() -> None:
+    head = "h1"
+    all_finders = [
+        FinderCandidate(
+            angle=each_angle,
+            file_path=f"{each_angle}.py",
+            line_number=1,
+            mechanism="m",
+            scenario="s",
+            worktree_path=f"/wt/{each_angle}",
+            leader_socket=f"sock-{each_angle}",
+            advisor_session_id=f"adv-{each_angle}",
+            reviewed_head=head,
+        )
+        for each_angle in ALL_MEDIUM_FINDER_ANGLES
+    ]
+    batch = run_medium_review(
+        target_head=head,
+        diff_base="b",
+        all_finder_candidates=all_finders,
+        verdict_by_key={},
+        severity_by_key={},
+        live_head=head,
+        is_any_advisor_blocked=True,
+    )
+    assert batch.is_rejected is True
+    assert batch.rejection_reason == "advisor_blocked"
+
+
+def test_retain_verified_findings_keeps_confirmed() -> None:
+    candidate = FinderCandidate(
+        angle="correctness",
+        file_path="a.py",
+        line_number=2,
+        mechanism="null",
+        scenario="boom",
+        worktree_path="/wt/x",
+        leader_socket="s",
+        advisor_session_id="a",
+        reviewed_head="h",
+    )
+    kept = retain_verified_findings(
+        all_candidates=[candidate],
+        verdict_by_key={("a.py", 2, "null"): VERDICT_CONFIRMED},
+        severity_by_key={("a.py", 2, "null"): "high"},
+    )
+    assert len(kept) == 1
+    assert kept[0].verdict == VERDICT_CONFIRMED

package/skills/grok-spawn/SKILL.md

@@ -231,3 +231,8 @@ Sibling skill: `/grokify` for a single paste-ready interactive Grok Build handof
 
 - `SKILL.md` — hub and process.
 - `reference/` — brief templates and flag profiles.
+
+## Worker advisors
+
+Each grok worker binds a unique Opus-high dvisor_session_id through the lead-supplied dvisor.launcher in the batch spec (committed default is a placeholder). Reports require the same handle\'s ENDORSE (or bounded CORRECTION/PLAN then ENDORSE); STOP or malformed signals end as advisor_blocked.
+

package/skills/orchestrator/SKILL.md

@@ -358,3 +358,8 @@ no open work remains, run `set --status done` before any re-arm attempt.
 - `scripts/` — deterministic status_gate.
 - Advisor policy:
   [`_shared/advisor/advisor-protocol.md`](../../_shared/advisor/advisor-protocol.md).
+
+## File-backed run ledger
+
+When host task tools are absent, reconcile delegated work through `scripts/grok_run_ledger.py` under the run-state directory (stable task ids, one live owner, unique advisor sessions, dependency blocking, snapshot-drift reopening).
+

package/skills/plan-to-pr/scripts/create_packet.py

@@ -8,10 +8,10 @@ import subprocess
 import sys
 from pathlib import Path
 
-if str(Path(__file__).parent) not in sys.path:
-    sys.path.insert(0, str(Path(__file__).parent))
-
-from config.constants import (
+_scripts_directory = str(Path(__file__).resolve().parent)
+if _scripts_directory not in sys.path:
+    sys.path.insert(0, _scripts_directory)
+from load_skill_constants import (
     PACKET_CREATION_ERROR_EXIT_CODE,
     PACKET_JSON_INDENT_LEVEL,
     SLUG_PATTERN,

package/skills/plan-to-pr/scripts/load_skill_constants.py

@@ -0,0 +1,41 @@
+"""Load plan-to-pr skill constants without colliding with repo-root config.
+
+Repo pytest sets ``pythonpath = .``, so a bare ``from config.constants import …``
+can bind the monorepo root ``config`` package instead of this skill's
+``scripts/config/constants.py``. Load the skill file under a unique module name
+and re-export its public names for script imports.
+"""
+
+from __future__ import annotations
+
+import importlib.util
+import sys
+from pathlib import Path
+from types import ModuleType
+
+
+def _load_skill_constants_module() -> ModuleType:
+    """Return the skill-local constants module, loading it once per process."""
+    skill_constants_module_name = "plan_to_pr_scripts_config_constants"
+    skill_constants_path = Path(__file__).resolve().parent / "config" / "constants.py"
+    existing_module = sys.modules.get(skill_constants_module_name)
+    if existing_module is not None:
+        return existing_module
+    module_spec = importlib.util.spec_from_file_location(
+        skill_constants_module_name, skill_constants_path
+    )
+    if module_spec is None or module_spec.loader is None:
+        raise ImportError(
+            f"unable to load plan-to-pr skill constants from {skill_constants_path}"
+        )
+    loaded_module = importlib.util.module_from_spec(module_spec)
+    sys.modules[skill_constants_module_name] = loaded_module
+    module_spec.loader.exec_module(loaded_module)
+    return loaded_module
+
+
+_skill_constants = _load_skill_constants_module()
+for each_constant_name, each_constant_binding in _skill_constants.__dict__.items():
+    if each_constant_name.startswith("_"):
+        continue
+    globals()[each_constant_name] = each_constant_binding

package/skills/plan-to-pr/scripts/validate_packet.py

@@ -9,10 +9,10 @@ import shlex
 import sys
 from pathlib import Path
 
-if str(Path(__file__).parent) not in sys.path:
-    sys.path.insert(0, str(Path(__file__).parent))
-
-from config.constants import (
+_scripts_directory = str(Path(__file__).resolve().parent)
+if _scripts_directory not in sys.path:
+    sys.path.insert(0, _scripts_directory)
+from load_skill_constants import (
     COMMAND_SEPARATOR,
     HANDOFF_ACCEPTANCE_PREFIX,
     HANDOFF_ALLOWED_FILES_PREFIX,

package/skills/plan-to-pr/scripts/validate_protocol.py

@@ -10,7 +10,10 @@ import sys
 from collections.abc import Mapping, Sequence
 from pathlib import Path
 
-from config.constants import (
+_scripts_directory = str(Path(__file__).resolve().parent)
+if _scripts_directory not in sys.path:
+    sys.path.insert(0, _scripts_directory)
+from load_skill_constants import (
     ALL_ALLOWED_RECORD_FIELDS,
     ALL_RECORD_FIELDS,
     ALL_REPAIR_FIELDS,

package/skills/plan-to-pr/scripts/validate_run.py

@@ -8,7 +8,10 @@ import sys
 from collections.abc import Mapping, Sequence
 from pathlib import Path
 
-from config.constants import (
+_scripts_directory = str(Path(__file__).resolve().parent)
+if _scripts_directory not in sys.path:
+    sys.path.insert(0, _scripts_directory)
+from load_skill_constants import (
     COMMIT_RANGE_ARGUMENT_INDEX,
     COMMIT_RANGE_SEPARATOR,
     EXIT_CODE_INVALID_SET,

package/skills/pr-converge/scripts/check_convergence.py

@@ -16,17 +16,16 @@ Each bypass flag closes one reviewer gate when that reviewer is unavailable.
 the Copilot review and pending-review gates. ``--bugteam-post-blocked`` skips
 the bugteam CLEAN-review gate. ``--codex-down`` skips the Codex review gate.
 
-Each flag also honors its own reviews-disabled token: "bugbot", "copilot",
-"bugteam", or "codex". A caller that cannot pass the flag reaches the same
-bypass by exporting the token. The mark-ready blocker hook re-runs this script
-with no flags, so its convergence re-check reads the bypass from the exported
-token instead. For Codex, sticky job-dir state ``codex_down: true`` is a third
-bypass source when the original run could not re-pass ``--codex-down``.
-
-Copilot and Bugbot waivers are disk-authoritative.
+Bugbot, bugteam, and codex are off by default. Each gate runs only when
+``CLAUDE_REVIEWS_ENABLED`` lists its token, and a token in
+``CLAUDE_REVIEWS_DISABLED`` forces one off even when the opt-in lists it.
+Copilot runs by default and stops only when the disabled list names it. For
+Codex, sticky job-dir state ``codex_down: true`` is a further bypass source
+when the original run could not re-pass ``--codex-down``.
+
+Every reviewer waiver is disk-authoritative.
 When ``~/.claude/settings.json`` is readable, its env block is the single source.
 The frozen process env is only a fallback when that disk read fails (logged once).
-Bugteam's opt-out is env-only via ``_resolve_bugteam_post_blocked``.
 A probe error does not waive the gate; the live GitHub checks still run.
 
 The Codex gate is conditional-required: it demands
@@ -105,11 +104,11 @@ from pr_converge_skill_constants.constants import (
 )
 from reviews_disabled import (
     is_bugbot_disabled_via_env,
-    is_bugteam_disabled_via_env,
-    is_codex_disabled_via_env,
     is_copilot_disabled_via_env,
 )
 from check_convergence_availability import (
+    _is_bugteam_disabled_via_resolved_settings,
+    _is_codex_disabled_via_resolved_settings,
     _resolve_bugbot_waiver,
     _resolve_copilot_waiver,
     _waiver_from_cli_flag,
@@ -815,18 +814,21 @@ def _resolve_copilot_down(is_copilot_down_flag: bool) -> bool:
 
 
 def _resolve_bugteam_post_blocked(is_bugteam_post_blocked_flag: bool) -> bool:
-    """Combine the --bugteam-post-blocked flag with the bugteam env opt-out.
+    """Combine the --bugteam-post-blocked flag with the resolved bugteam opt-in.
 
     ::
 
-        flag True, env unset                        -> True   (caller passed the flag)
-        flag False, reviews-disabled lists bugteam  -> True   (exported token)
-        flag False, env unset                       -> False  (gate runs)
+        flag True                                   -> True   (caller passed the flag)
+        flag False, reviews-enabled lists bugteam   -> False  (gate runs)
+        flag False, neither list names bugteam      -> True   (off by default)
+        flag False, reviews-disabled lists bugteam  -> True   (opt-out wins)
 
-    The mark-ready blocker hook re-runs this script with no flags, so the env
-    fallback lets an exported bugteam token carry the bypass into that re-check.
+    Bugteam is off by default and runs only on an explicit opt-in. Settings on
+    disk are the source when readable, so a settings.json opt-in reaches the
+    mark-ready blocker hook, which re-runs this script with no flags. The
+    process env is the fallback when that disk read fails.
     """
-    return is_bugteam_post_blocked_flag or is_bugteam_disabled_via_env()
+    return is_bugteam_post_blocked_flag or _is_bugteam_disabled_via_resolved_settings()
 
 
 def _resolve_codex_down(
@@ -854,7 +856,7 @@ def _resolve_codex_down(
     """
     return (
         is_codex_down_flag
-        or is_codex_disabled_via_env()
+        or _is_codex_disabled_via_resolved_settings()
         or _read_codex_down_from_job_state(all_job_state_fields)
     )